Employee Offboarding: Secure Business Number Access

Quick answer: treat offboarding as a coordinated access change across the business identity account, the phone-number provider and any services that rely on the number. An authorised administrator should preserve necessary business records, establish a supported replacement administrator and then revoke the departing person's access through each service's official process.

Define the departure and the authority to act

Consider an operations assistant who manages customer calls and receives recovery messages for a company supplier portal. Removing the assistant from email may leave a browser session at the number provider, while disabling the phone number may interrupt the supplier account. These are different dependencies with different owners.

Before changing anything, identify the authorised business decision-maker, the effective departure time and the systems in scope. Separate a routine handover from a suspected compromise. If there is an active security incident, follow the organisation's incident procedure rather than waiting for a convenient handover meeting. Do not access an employee's personal accounts to search for company information.

Create a service-by-service checklist

Use one row per service, not one row per employee. Record whether the departing person is a user, administrator, billing contact, recovery contact or the sole account holder. The last category needs provider involvement if a supported reassignment path is unclear.

A checked email row does not close the provider row. This simple distinction prevents a manager from declaring the departure complete while another system remains dependent on the former employee.

Preserve records before deleting an identity account

For a Google Workspace example, Google's official user-removal guidance distinguishes account removal from handling the user's data. An authorised Workspace administrator should review the current preservation and transfer options before deletion. The correct choice depends on the organisation's requirements and available controls.

Do not turn that example into a universal menu sequence for every workspace product. Verify the relevant vendor's current documentation, available administrator rights and retention obligations. Record the chosen action and the person who approved it. A screenshot of a deletion confirmation is not evidence that all necessary business material was preserved beforehand.

Establish ongoing control using supported mechanisms

Where a service supports individual business users, grant the replacement person only the required rights through its official invitation flow. Where the account model is different, ask the provider how to update the authorised administrator or account holder. Do not assume that PhoneBorn includes team seats, delegated roles or an account-transfer switch.

For a retained PhoneBorn number plan, identify the approved account contact and confirm the provider's process before a personnel change removes the only authorised access path. A new password alone does not establish whether the business is entitled to change the account holder. Keep commercial authority and technical access as separate checks.

Remove recovery dependencies deliberately

List accounts where the departing person's email, phone, authenticator or security key is a recovery dependency. Replace each through the service's supported settings while an authorised session remains available. Some changes require extra verification or a waiting period; plan around those conditions rather than trying repeated requests to force them through.

Use the safe account-number change checklist for the actual migration sequence. Offboarding adds an organisational requirement: someone other than the departing employee must verify the result and accept responsibility for the new recovery arrangement. Do not save recovery codes inside the departure checklist.

Revoke, test and document closure

Follow each vendor's documented controls for revoking sessions, removing users, rotating shared secrets where applicable and retiring device access. The Australian Cyber Security Centre's access-management guidance is a useful reference for reviewing who retains access. The exact controls remain service-specific.

Then have the replacement authorised person demonstrate the required business workflow. Check current number access, a non-sensitive customer-contact task and the next renewal responsibility. Avoid paid test calls unless separately approved. Record unavailable tests as pending rather than marking them passed. Retain the checklist in the company's restricted records, with unnecessary personal details removed.

Frequently asked questions

Is disabling company email enough?

No. It may affect some linked sessions or future sign-ins, but it does not prove that every provider session, token or recovery method has been revoked. Complete the service rows individually and follow each vendor's documented process.

Can we keep using a departing employee's personal number?

Do not assume permission or ongoing access. Agree on an authorised transition and move business dependencies through official account settings. If the number remains personally controlled, it should not be treated as a dependable company recovery asset.

Should we replace the business number immediately?

Only after assessing the consequences. Replacing a customer-facing number creates publication and recovery work. If supported administration changes preserve the existing line, that may reduce disruption. If continuing control cannot be established, plan a new-number transition and use the number-retirement checklist.